“Permission denied (publickey)” means the server refused to accept any public key your SSH client offered. It does not name the cause. The fix depends on which of three things is failing: your client is offering no key or the wrong one, the key you are offering is not registered with the account or server, or the key is not usable locally because its file permissions are wrong or it is not loaded in your SSH agent. The steps below separate those cases so you can fix the one that applies.
What the error means
GitHub’s troubleshooting documentation, “Error: Permission denied (publickey),” puts it plainly: “A “Permission denied” error means that the server rejected your connection.” GitLab’s SSH troubleshooting guidance lists the usual reasons the server rejects a connection: the public key was never added to the account, the key type is not supported by the service, SSH is trying the wrong private key, the private key cannot be read, the local permissions on your key files are incorrect, or the key is not loaded into ssh-agent.
As an Amazon Associate I earn from qualifying purchases.
Because all of these produce the same message, the useful question is not “what does this error mean?” but “which of these conditions is true on my machine?” The sections below answer that in order.
Diagnose the connection step by step
1. Confirm the host and the username
For GitHub, the SSH username is git, not your GitHub account name. Test the connection with:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh -T [email protected]
Make sure the host is the one you intend. If your SSH configuration points github.com at a different key or host alias, the test may run against something you did not expect. GitHub’s normal SSH connection uses port 22 unless your setup has been changed, for example to SSH over HTTPS.
Do not reuse [email protected] on unrelated servers. Each server defines its own accepted username, and a self-managed server may use a different one entirely.
2. Read the verbose output
Verbose output shows which identity files SSH found and which public key it actually offered. For GitHub, run:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
ssh -vT [email protected]
For GitLab, substitute your own host:
ssh -Tvvv [email protected]
In GitHub’s example output, identity file lines ending in type -1 followed by “Trying private key” lines with no offered key mean SSH found no usable key. If you see a line showing an offered public key and the connection is still refused, the problem is registration or a wrong key, not a missing file.
3. Check which keys are loaded and which one is selected
List the fingerprints of keys currently held by your agent:
ssh-add -l -E sha256
If your key has a non-default filename, such as ~/.ssh/id_ed25519_work, SSH will not try it automatically. Test it explicitly:
ssh -i ~/.ssh/id_ed25519_work -vT [email protected]
To make that choice permanent for one host, add an entry to ~/.ssh/config:
Host github.com
IdentityFile ~/.ssh/id_ed25519_work
IdentitiesOnly yesIdentitiesOnly yes stops SSH from offering every other key in your agent first, which matters when several keys are configured. GitLab also recommends checking for multiple keys and defining which one to use for each host.
4. Confirm the key is registered with the account
Compare the fingerprint from ssh-add -l -E sha256 with the keys attached to your account. On GitHub, open your account settings and review the SSH keys list. On GitLab, check the SSH keys section of your user profile. An unregistered public key is one of the most common causes of this error. If the fingerprints do not match, either add the correct public key to the account or switch to the private key whose public half is already registered.
5. Check local permissions and agent state
GitLab’s documented permissions for SSH files are 600 for the private key and 700 for the .ssh directory. Set them with:
chmod 600 ~/.ssh/id_ed25519_work
chmod 700 ~/.ssh
Also confirm that the private key is readable by the same local account that runs SSH. If the key is not in the agent, load it with ssh-add ~/.ssh/id_ed25519_work. Agent contents do not survive every new session on every system, so a new terminal or a reboot can leave a key unloaded even though it worked earlier.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. Do not run Git through sudo
GitHub warns that using sudo or other elevated privileges with Git can make SSH use a different user’s keys than the ones you generated or loaded in your normal account. A command that works as your user and fails under sudo is a strong sign of this. Run Git as your normal user and fix ownership of the affected files instead.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Match the symptom to the fix
| What you see | Most likely cause | Next check |
|---|---|---|
Identity file lines end in type -1; no public key is offered |
SSH found no usable key for this host | Run ssh-add -l -E sha256; add an IdentityFile entry for the host |
| A public key is offered, but the server still refuses it | The key is not registered with the account, or it is the wrong key | Compare the fingerprint with the keys in your account settings |
Your key file exists but does not appear in ssh-add -l |
The key is not loaded into the agent | Run ssh-add with the key path, then retest |
Works in your terminal, fails under sudo |
Elevated command uses a different user’s keys | Run the Git command without sudo |
| Key is present but SSH ignores or rejects it | Private key or .ssh permissions are too open or unreadable |
Apply 600 to the private key and 700 to .ssh |
Self-managed servers
If you are connecting to a server you run yourself, GitHub and GitLab’s guidance does not apply directly. Their pages cover their own hosted services, and their account names and setup steps will not match a general SSH server. On the server side, check the target account’s ~/.ssh/authorized_keys file for your public key, confirm that the account’s home directory and .ssh folder are not writable by other users, and read the server’s authentication log. On many Linux distributions that log is /var/log/auth.log, though location varies by system. If the fingerprint matches, the local permissions are correct, and the server log still shows rejection, the cause is usually in the server’s SSH configuration or account policy, and the server’s administrator is the right person to resolve it.
Hardware-backed keys (optional)
Some users configure SSH keys stored on a FIDO2 hardware security key. This is a deliberate setup choice, not a general fix for this error. GitLab’s FIDO2 key instructions call for OpenSSH 8.2 or later on the client, and for a physical key that supports the key type you want to create. If you are not already using a hardware-backed key, the earlier steps are more likely to resolve the problem.
When the error does persist after the checks above, record the output of ssh -vT for your host and the server-side log entry before changing anything else. Those two pieces of evidence show whether the client offered a key, which key it offered, and whether the server rejected it.
Source note: the guidance above reflects the current GitHub Docs and GitLab Docs troubleshooting pages as of October 2026. Their commands and labels can change, so check the relevant service’s documentation when a step does not match what you see.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
